110
votes
Accepted
Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?
From a security perspective, you need to revalidate everything on the server. This will always be the case, no matter how pretty and advanced HTML5 features become. You simply can not trust the client....
- 65.8k
90
votes
Security risks of user generated HTML?
User-defined HTML
You're attempting to sanitize user input by blacklisting things you don't want to allow. Unfortunately, especially given the very large list of options for HTML5, it's quite easy to ...
- 31.7k
22
votes
Security risks of user generated HTML?
Currently these are the tags that are banned:
In addition to what's already been posted, make sure that banning means "don't letting the user save the data", not "remove the banned stuff and save ...
- 318
10
votes
Accepted
Passing PHP code directly into JavaScript in HTML5
JSON_HEX_TAG
If you are echoing into JS inside a HTML document (as you are in your example), this is necesarry or you risk opening up a huge XSS vulnerability. Without this one, an attacker can post ...
- 65.8k
9
votes
Accepted
Why is a "tainted canvas" a risk?
What exactly would that image request URL look like?
It need not be anything complicated or abnormal. There are two main ways this could work (were it not for the restrictions in the browser):
In ...
- 65.8k
8
votes
Protecting against input type ="password" changes?
Well, you can do it using the MutationObserver API.
const inputPasswordElements = document.querySelectorAll('input[type=password]');
const observer = new MutationObserver(function (mutations) {
...
- 14.7k
7
votes
Accepted
Why is sub resource integrity (SRI) only limited to certain files?
Why is it limited to JS and CSS resources?
But, why is it only limited to JS and CSS files?
The W3C SRI specification states:
The scheme specified here also applies to link and future versions ...
- 1,088
6
votes
Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?
As Anders stated, client-side validation is irrelevant for the security of the application, but very important from the UX point of view.
Client-Side validation is focused o providing the user a ...
- 121
6
votes
Preventing CSRF attacks against WebSocket communications
A CSRF attack on WebSocket is possible, if you rely on authentication cookies. From RFC 6455 §1.3:
The |Origin| header field [RFC6454] is used to protect against unauthorized cross-origin use of a ...
- 709
6
votes
Accepted
Is using enctype="multipart/form-data" always a bad idea?
Using enctype="multipart/form-data" creates both a binary and an ascii upload
I consider this statement wrong. There is application/x-www-form-urlencoded where the body of the POST request consists ...
- 208k
6
votes
Security risks of user generated HTML?
Leaving aside all the ways I could still slip XSS past this blacklist (which other answers have largely covered), allowing arbitrary HTML is still very dangerous. For example, if the user has control ...
- 52.3k
5
votes
Security risks of user generated HTML?
There are major risks with user generated content that is to be interpreted/parsed and displayed publicly. XSS attacks and the like can occur from users being able to sneak tags through your ...
- 660
5
votes
Alternatives to HTML's deprecated <keygen> for client certs?
The WebCrypto API is currently not an alternative for the keygen tag, as confirmed by the WebCrypto API spec:
This API, while allowing applications to generate, retrieve, and manipulate keying ...
- 163
4
votes
Alternatives to HTML's deprecated <keygen> for client certs?
In case you already have a <keygen>-based setup and want to keep using it, I created a project which attempts to implement a JavaScript polyfill for <keygen>:
https://github.com/...
4
votes
How to Pass Authorization Header in HTTP Request when using HTML5 Player (Audio tag) for security
You cannot add any custom headers this way.
The established way to add user specific authorization is to have a session cookie. If such a cookie is set for the target URL (i.e. the user is already ...
- 208k
3
votes
Accepted
Is there a way to use clear key encryption for protecting media HTML5 media streams?
The point of EME with clear key encryption is to provide an easier to implement encryption for content that is slightly more difficult to steal and share. If you really need to protect your content, ...
- 218
3
votes
Is it secure to share an access token via HTML5 messaging API between various iframes?
The postMessage API is designed for cross domain communication as part of the Cross Origin Resource Sharing mechanism.
The Window.postMessage() method, introduced in HTML5, allows JavaScript code ...
- 7,497
2
votes
Malware through HTML 5 player
There are no known public sandbox escapes for the latest version of Chrome so this would require a Chrome 0-day. This means that while it is not impossible it is very unlikely that a particular person ...
- 446
2
votes
JWT authentication or cookies?
Reasons to pick JWT:
Does not require the server to keep a state, i.e. no need for costy lookup on every request.
Easier to share authorisation across different domains.
Reasons to pick session ...
- 65.8k
2
votes
Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?
None of the answers so far really mention it, so let me add this:
The reason why anything in your HTML is completely irrelevant for security is that any attacker can, trivially, create requests ...
- 2,409
2
votes
How to Pass Authorization Header in HTTP Request when using HTML5 Player (Audio tag) for security
You can use fetch:
<audio controls>
<source id="my-audio" type="audio/mp3" />
</audio>
var url =
"https://storage.googleapis.com/media-session/sintel/...
- 121
2
votes
Stealing page source via Clickjacking
Stealing information is not easily possible and not what Clickjacking is really about.
Clickjacking is functionally similar to CSRF, in that you can perform actions on the site across origins, but ...
- 29.8k
2
votes
Accepted
Do interactive ads on Android pose a security risk?
Maybe, maybe not. This will primarily depend on the ad wrapper used by the application. Most applications don't write their own libraries to display ads, instead they used a library provided by the ad ...
- 31.6k
2
votes
Do interactive ads on Android pose a security risk?
As the famous quote says "If something is free, you are the product". So, most of the free applications in order to generate revenues use ads as a means. However, the ecosystem around the ads isn't ...
- 141
2
votes
Accepted
What data related to a specific web page can be obtained outside the browser?
You should avoid consider storing sensitive data at all. Conceptually, if a system is compromised, it doesn't matter where you store the data; any code that can examine's the browser's memory doesn't ...
- 5,754
2
votes
Accepted
What security concerns are there for a fully client-side JS/HTML5 app?
When you say that the JS and HTML is hosted on GitHub, I am assuming you mean that the code is hosted there for download only and that your interactive story does not reach out to GitHub while running ...
- 437
1
vote
Can a javascript on parent page log keystrokes inside an iframe?
1)Yes
2) No (although plugins could in theory alter this behaviour, but I do not know of any myself)
3)Unless there is a vulnerability exploited in a browser that is yet to be patched, or the use of ...
- 3,300
1
vote
JWT authentication or cookies?
Use both. Just take a few measures to prevent identity theft.
Okay, but let's talk how to do that.
JWT is not a replacement for cookies. It couldn't be, as they have different purposes.
In a web ...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible